p PatchFirst

CVE-2016-8859

CVE-2016-8859

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.

CVSS 9.8 · Critical · EPSS 3.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • musl Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.1.15-2

    Update to 1.1.15-2

  • musl Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.1.15-2

    Update to 1.1.15-2

  • musl Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.1.15-2

    Update to 1.1.15-2

  • tre Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.8.0-5

    Update to 0.8.0-5

  • tre Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.8.0-5

    Update to 0.8.0-5

  • tre Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.8.0-5

    Update to 0.8.0-5

  • tre Ubuntu:14.04:LTS

    Versions
    • 0.8.0-3
    • 0.8.0-3ubuntu1
    Affected ranges
    • ECOSYSTEM: < 0.8.0-3+deb7u1ubuntu1

    Update to 0.8.0-3+deb7u1ubuntu1

  • musl Ubuntu:Pro:14.04:LTS

    Versions
    • 0.9.14-2
    • 0.9.14-2ubuntu1
    • 0.9.15-1
    Affected ranges
    • ECOSYSTEM: < 0.9.15-1ubuntu0.1~esm1

    Update to 0.9.15-1ubuntu0.1~esm1

  • tre Ubuntu:16.04:LTS

    Versions
    • 0.8.0-4
    Affected ranges
    • ECOSYSTEM: < 0.8.0-4+deb8u1build0.16.04.1

    Update to 0.8.0-4+deb8u1build0.16.04.1

  • musl Ubuntu:Pro:16.04:LTS

    Versions
    • 1.1.9-1
    Affected ranges
    • ECOSYSTEM: < 1.1.9-1ubuntu0.1~esm2

    Update to 1.1.9-1ubuntu0.1~esm2

Original sources

Check your server →